Subject: [Suit] More complete example for firmware encryption

From: Hannes Tschofenig <[email-masked]>
Date: Tue, 12 Apr 2022 11:22:54 +0000

Hi all,

Following the recent IETF meeting I wanted to provide you a more detailed version of a SUIT manifest with firmware encryption.

What you see below is a SUIT envelope that contains

  *   An authentication wrapper covering the manifest,
  *   The suit-protection-wrappers, which contains the COSE_Encrypt structure.
  *   The manifest (which contains the suit-cek-verification).

The firmware image itself is detached and not included in the example manifest. It would be encrypted.

The manifest example is taken from the SUIT manifest draft itself.

The plan is to include this example (with real values for the various fields) into a future version of the draft.

107({
                  / authentication-wrapper / 2:
                  <<[
                                  digest:
                                  <<[
                                                  / algorithm-id / -16 / "sha256" /,
                                                  / digest-bytes /  h'60c...132'
                                  ]>>,
                                  signature:
                                  <<18([
                                                                  / protected /
                                                                  <<{
                                                                                  / alg / 1:-7 / "ES256" /,
                                                                  }>>,
                                                                  / unprotected / {},
                                                                  / payload / F6 / nil /,
                                                                  / signature / h'524...389'
                                  ])>>
                                  ]
                  ]>>,
                  / suit-protection-wrappers / TBD:
                  <<[
                  / COSE_Encrypt /
                                [
                                                / protected header with alg=AES-GCM-128 /
                                                h'a10101',
                                                / unprotected header with nonce /
                                                {5: h'938b528516193cc7123ff037809f4c2a'},
                                                / detached ciphertext /
                                                null,
                                                / recipient structure /
                                                [
                                                   / protected field with alg for HPKE /
                                                   h'a1013863',
                                                   / unprotected header /
                                                   {
                                                                  / ephemeral public key with x / y coodinate /
                                                                  -1: h'a40...c39',
                                                                  /  kid for recipient static ECDH public key /
                                                                  4: h'6b69642d32',
                                                   },
                                                   / encrypted CEK /
                                                   h'9ab...062',
                                                ],
                                ]
                  ]>>,
                  / manifest / 3:
                  <<{
                                  / manifest-version / 1:1,
                                  / manifest-sequence-number / 2:1,
                                  / common / 3:
                                  <<{
                                                  / components / 2:[
                                                                  [h'00']
                                                  ],
                                                  / common-sequence / 4:
                                                  <<[
                                                                  / directive-override-parameters / 20,
                                                                  {
                                                                                  / vendor-id /
                                                                                  1:h'fa6...afe' /,
                                                                                  / class-id /
                                                                                  2:h'149...b45' /,
                                                                                  / image-digest / 3:
                                                                                  <<[
                                                                                                  / algorithm-id / -16 / "sha256" /,
                                                                                                  / digest-bytes / h'0011223343210'
                                                                                  ]>>,
                                                                                  / image-size / 14:34768,
                                                                                  / suit-cek-verification / TBD2:h'abc..def',
                                                                  } ,
                                                                  / condition-vendor-identifier / 1,15,
                                                                  / condition-class-identifier / 2,15
                                                  ]>>,
                                  }>>,
                                  / install / 9:
                                  <<[
                                                  / directive-set-parameters / 19,
                                                  {
                                                                  / uri / 21:'http://example.com/file.bin',
                                                  } ,
                                                  / directive-fetch / 21,2 ,
                                                  / condition-image-match / 3,15
                                  ]>>,
                                  / validate / 10:
                                  <<[
                                                  / condition-image-match / 3,15
                                  ]>>,
                  }>>,
  })

Ciao
Hannes

IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.